3 SAFETY ANALYSIS OF CTR OPERATIONS
3.3 Development of the Three Safety Analysis Scenarios
3.3.1 Scenario 1—Interconnect Driveshaft System (ICDS) Failure During a VTOL
3.3.1.1 Scenario
A CTR is performing a VTOL takeoff from the Newark Liberty (notional) vertiport (shown as site #5 in figure 3-5). After achieving a stabilized hover, the nacelles are translated to 75 degrees in order to begin climbing as shown in a representative takeoff and climb profile, figure 3-6 (ref. 1). Before reaching 400-foot altitude and 90-knot airspeed – flight conditions where nacelle rotation to 0 degrees would nominally begin – an ICDS failure indication occurs. The weather condition is moderate rain with winds gusts up to 20 knots from the north and Category I. Instrument Flight Rules (IFR) landing conditions are in effect. The airport is using both parallel runways for fixed-wing operations as shown in figure 3-5.
5
2 1
3
4
5
2 11
33
44
Figure 3-5. Possible vertiport sites at EWR.
3.3.1.2 Identify Hazard
The flight crew declares an emergency and prepares for a takeoff and go around (TOGA) to attempt a landing on the runway with minimum crosswind. Given the weather conditions, this would mean a STOL landing on runway 4L (see figure 3-5). Figure 3-5 shows the possible vertiport sites considered in reference 1, where site #5 was chosen to be optimal for CTR operations. The declaration of emergency with the subsequent TOGA presents potential hazards in the ability of the CTR to continue the takeoff and eventually land safely.
Figure 3-6. 30-passenger takeoff time history, VTO.
A 30-passenger CTR takeoff time history from a pilot-in-the-loop (PITL) flight simulation from reference 1 is shown in figure 3-6. It is assumed for the purposes of this analysis that a 120-passenger CTR will be flying a similar trajectory as the 30-passenger CTR.
The main purpose of the ICDS is to provide power to both rotors in the event of a single-engine failure, as well as to synchronize the rotor. In the event of an ICDS disconnect, the crew would default to a STOL roll-on landing (ROL) roll-on the runway that minimizes crosswind. The ROL is preferred because it is easier and requires less power, and by minimizing crosswind there is less opportunity for an engine speed (Np) mismatch. While a VTOL landing is possible, it is more difficult to effect because, in hover mode, unmatched engine speeds can result in degraded lateral handling qualities.
3.3.1.3 Risk Assessment
Given the above, now that a potential hazard has been identified, the next step in the SMS process is to analyze the risk. Risk is a composite of the predicted severity and likelihood of the potential effect of that hazard in the worst credible system state. As the hazard is evaluated with respect to NAS operations from a systems perspective, any potential condition that currently exists that could prevent or reduce the hazards occurrence, or mitigate its effects, can be identified. These mitigations are called “existing controls” (ref. 12).
Table 3-1 provides some examples of existing controls.
Severity Analysis
The severity of the hazardous event is the determination of how bad the adverse results of an event are predicted to be. As previously stated, the worst credible outcome must be considered. The outcome of the severity analysis is completely independent of the determination of the likelihood of the event occurring. The severity definitions used in this study come from the Federal Aviation Administration/Air Traffic Organization (FAA/ATO) SMS Manual(ref. 12) and are shown in tables 3-2 and 3-3.
TABLE 3-1. EXAMPLES OF EXISTING CONTROLS FOR RISK MITIGATION
For this scenario existing controls (table 3-1) that may mitigate the severity would be:
1. Air traffic procedures. There are specific standard operating procedures (SOPs) for dealing with an aircraft that declares an emergency during takeoff. This includes flight to the missed approach fix and clearing other aircraft in the path of the impacted aircraft for an emergency landing.
2. Flight crew. Flight crews are trained in takeoff and go-around operations. While Traffic Collision Avoidance System (TCAS) is not operational below 1,000 feet (today’s procedures), Automatic Dependent Surveillance-Broadcast (ADS-B) out and Cockpit Display of Traffic Information (CDTI) are functioning. This gives the crew situational awareness of local traffic.
TABLE 3-2. SEVERITY DEFINITIONS FOR ATC SERVICES AND FLIGHT CREW
TABLE 3-3. SEVERITY DEFINITIONS FOR FLYING PUBLIC
Severity Analysis Result: Given the conditions of the scenario with respect to the severity definitions, this event is potentially “Major” or “Hazardous” considering the existing controls mentioned. Looking at the scenario from an ATC services perspective, the missed approach must be executed because the landing (ref. 13) was rejected. Any missed approach below the Missed Approach Point (MAP) involves additional risk because the Aircraft Flight Manual (AFM) contains performance information for climbing from, at, or before the MAP. Starting the missed approach after the MAP creates concerns about the aircraft and its climb performance with respect to obstacle clearance, as well as avoiding other traffic in the congested airspace, resulting in a category A or B operational error (OE) (ref. 14). Current helicopter instrument procedures limit the missed approach speed to 70 knots indicated airspeed (KIAS) (ref. 13). Exceeding the airspeed restriction increases the turning radius and could cause the aircraft to leave the missed-approach protected airspace. The result could be collision with an obstacle or potential aircraft collision.
Likelihood Analysis
The likelihood of a hazardous event is the expression of how often a particular event will occur and is determined by how often one can expect the resulting event to occur at the worst credible severity. The likelihood definitions shown in table 3-4 were developed as part of the FAA/ATO SMS Manual (ref. 12).
Besides the definitions shown in table 3-4, there is the requirement of Federal Aviation Regulation (FAR) section 25.1309 (ref. 15) and FAA Advisory Circular (AC) 25.1309-1A (ref. 16) that would be applied to the certification of a commercial CTR. The regulation contains the terms “extremely improbable” and
“improbable.” The AC defines extremely improbable as “so improbable they are not anticipated to occur during the entire operational life of all aircraft of that type.” Improbable is defined as “not anticipated to
occur during the entire operational life of a single random aircraft.” They may occur occasionally during the entire operational life of all aircraft of one type. Because the life of any type of aircraft is 20–30 years, the AC definition of improbable can be equated with “remote” or “extremely remote” as defined in table 3-4.
Likelihood Analysis Result: Looking at the existing conditions given in tables 3-2 and 3-3, there are none that would mitigate an ICDS failure. Also, in accordance with current safety thinking, if the failure in question has previously happened, its occurrence in the future cannot be considered extremely improbable (e.g., DC-10 Sioux City accident in July 1989). Therefore, the likelihood should be either “Remote” or
“Extremely Remote.”
TABLE 3-4. LIKELIHOOD OF OCCURRENCE
Qualitative Risk Analysis
A risk matrix as shown in figure 3-7 is a graphical method used to determine risk levels. The columns in the matrix represent the severity categories, and the rows represent the likelihood categories. Three risk levels are used in the matrix:
1. High or unacceptable risk. Any risk determined to be high cannot be implemented unless the hazards associated with that risk are mitigated to a medium- or a low-risk level.
2. Medium or tolerable risk that meets the minimum acceptable safety requirements. The hazard may be accepted but with active management of operational tracking and monitoring. Management must buy-in to the decision.
3. Low or acceptable risk allows the design or operation to be used without any restriction or limitations.
NOTE: A catastrophic severity and corresponding improbable likelihood would normally be rated as a medium risk as long as the event is not the result of a single point or common-cause failure. If the hazard is the result of a single point or common-cause failure, the risk is categorized as a high risk and placed in the red part of the split cell at the bottom right corner of figure 3-7 (ref. 12). An example of a common-cause failure is simultaneous loss of all aircraft engine operation resulting in a loss of all electrical power due to fuel contamination, which represents a single common failure (ref. 12).
Figure 3-7. Risk matrix.
Qualitative Risk Analysis Result: As previously discussed, qualitative analysis of the severity of an ICDS failure places it as either major or hazardous. Also, analysis of the likelihood of the hazard places it at either remote or extremely remote. Given either of these conditions, the resulting risk is medium (tolerable) and, therefore, may be accepted if there is a management-approved plan for tracking and monitoring.
3.3.1.4 Risk Mitigation
Risk management is the assessment and mitigation of the risk resulting from a hazard and its resultant consequences that threaten to reduce safety below some target level that has been set by the organization responsible for risk management.
In mitigating risk, alternative strategies are developed for managing the risk associated with a particular hazard. These strategies are turned into potential actions that can be evaluated for their effectiveness at mitigating the unacceptable risk. These strategies fall into three basic categories:
1. Modify/change the system/component design, 2. Change operational procedures, and/or
3. Create contingency plans that include the occurrence of the hazard.
When looking at the design change strategy, there are two approaches to consider. They are changes to prevent or minimize the probability of the hazardous event and/or changes that minimize the consequence of the event. This study looks at both. When the CTR nacelle rotates from the airplane mode for a landing, the oil accumulated in the nacelle (when nacelle is at 0 degrees) could run into the engine and could be ignited by the hot engine components. The resulting corrective action is to provide drain holes in the nacelle, so oil will not accumulate. This mitigates the consequence of the potentially hazardous oil leak (ref. 17).
The interconnect drive system (ICDS) on the current military V-22 and future civilian AW609 functions to synchronize proprotor speed and to transfer power from the proprotor to all accessory equipment. The ICDS is identical on either side of the aircraft and consists of a series of drive shafts, couplings, and bearings that connect the mid-wing gearbox (MWGB) to the proprotor gearbox (PRGB). This is illustrated in figure 3-8 (ref. 18). One of the design challenges is to simplify and increase the robustness of the ICDS. This could be done by decreasing the number of drive shafts, decreasing the number of couplings, or changing the bearing design to make the entire ICDS more fault resistant. Perhaps a fault tolerant design with a redundant load path could be designed to eliminate a single-point-of-failure event.
Another strategy that can be considered to minimize the consequence of an ICDS failure would be to separate the flight control and power control paths using software. Software can link the advanced-technology flight management system (FMS) with the full authority digital engine control (FADEC). In the event of an ICDS failure, the pilot would input the proper flight commands into the aircraft systems through the flight controls to continue the climb-out. The FMS would take those control inputs and determine the necessary power of the individual engines, and link with the engines’ FADEC to allow application of proper engine power. A properly designed feedback control system, with the FADEC in the inner loop and the FMS in the outer loop, would serve to minimize any Np mismatches.
Another mitigation alternative would be to incorporate adaptive controls, which have been demonstrated in several studies (refs. 18–20) to show acceptable performance for handling degraded performance due to system failures, loss of control surfaces, or unpredictable external disturbances.
Driveshaft
Shaft Supports (Single Bearing)
Conversion Spindle
Tilt-Axis Gearbox Pylon Mounted
Driveshaft Shaft Supports
(Double Bearing)
Proprotor Gearbox
Figure 3-8. A representative tiltrotor drive system illustration.
These mitigations will need to be verified in an integrated pilot-in-the-loop (PITL) and controller-in-the-loop (CITL) simulation to verify that the safety procedures or methods developed under the given CTR ICDS failure can meet the safety requirements at given airspace constraints (e.g., interaction with the fixed-wing traffic, and pilot and controller’s interactions and workload).